KrBankerMalware
- blackmoon
ThreatPost describes KRBanker (Blackmoon) as a banking Trojan designed to steal user credentials from various South Korean banking institutions. It was discovered in early 2014 and since then has adopted a variety of infection and credential stealing techniques.From MISP Galaxy
Last reported 3 years ago, by Group-IB1 report
ATT&CK techniques
6 of 38 · each with the sentence it comes from- T1003OS Credential Dumping
“T1003”
- T1007System Service Discovery
“T1007”
- T1018Remote System Discovery
“T1018”
- T1021.001Remote Desktop Protocol
“T1021.001”
- T1021.004SSH
“T1021.004”
- T1027Obfuscated Files or Information
“T1027”
What the reports say
1 report, newest first · the exact sentence from each-
The old way: BabLock, new ransomware quietly cruising around Europe, Middle East, and Asia“It is worth mentioning that similar PE-module loader code has been observed in two other malware families, namely the banking Trojan KrBanker / BlackMoon and the TA505-related bot SDBbot.”
Indicators in its reports
named in the reports above- 4874d336c5c7c2f5…61ce9c38b86din 1 report
- 2fd264f58ba82a26…071f67bb67abin 1 report
- 03c41019faf7e4cc…4a20256c1813in 1 report
- 88081a21e500e831…b18a022f25bein 1 report
- aa48acaef62a7bfb…9a78864eb31fin 1 report
- b99d114b267ffd06…974bbce75bf2in 1 report
- 66bcad0829a59c42…bf65f13f3dc6in 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.